.Dd 5 August 2010
.Dt SIEVELOG.CONF 5
.Os
.Sh NAME
.Nm sievelog.conf
.Nd sievelog rules file
.Sh SYNOPSIS
sievelog.conf
.Sh DESCRIPTION
.Xr sievelog 1
reads rules from a file in
.Xr sievelog.conf 5
format. The file contains guard/action pairs, one per line. Guards are
separated from actions by the literal token
.Sq -> .
Rules may be split between
multiple lines using
.Sq \e
at the end of the line.
.Ss Evaluation Order
A rules file is normally evaluated top-to-bottom. If the
.Fl o
flag is passed to
.Xr sievelog 1 ,
however, the rules are evaluated in order of their relative frequency.
.Ss Guard Format
The general format of a guard is
.Qo Ao Ar regex Ac Qc Ns Bo i Bc .
The double-quotes surrounding
.Ar regex
are obligatory. The regular expression is directly fed to Python's
.Em re
module. The literal
.Sq i
may follow the regular expression to indicate it is to be treated as
case-insensitive.
A full description of the regular expression language is beyond the scope of
this manual. See Python's documentation for
.Em re
for details.
.Ss Action Format
An action is a string telling sievelog where to send a message that matches the
guard pattern. An action can be either a single token, like
.Sq /dev/null
or it can be a comma-delimited sequence of actions, like
.Sq /sievelog/out1, /sievelog/out2 .
Commas can not be escaped, so a rule like
.Sq /sievelog/out1,55
will not parse correctly.

Blocks of rules, one per line, can be enclosed within curly brackets and guarded
by a regex. These bodies of these compound rules are not reordered by the
ruleset optimizer.

.Ss Available Actions
.Bl -ohang -offset indent
.It Sy Pa /absolute/path/name
Append the matched message to the named file. Messages can be ignored by sending
them to
.Pa /dev/null .
.It Sy Ic mail Fa subject to from
Stick the matched message in an email with the given
.Ar subject
and send it with the given
.Ar to
and
.Ar from
addresses.
.Sh EXAMPLES

Write all messages containing
.Sq sudo
to a file and email them to interested parties:

.Bd
"sudo" ->\e
        /var/sievelog/sudo,\e
        mail "omg we're all going to die" sysadmin@example.com\e
								sievelog@example.com
.Ed

Use a compound rule to enforce ordering so your can filter out certain
messages from your Cisco ASA before dropping the remainder in
.Pa /sievelog/asa :

.Bd
"ASA" -> {
        "ASA-4-10602.*some-if:.*other-if:10\.1\.1\.72/137" -> /dev/null
        "ASA-4-10602" -> /sievelog/asa
}
.Ed
.Sh SEE ALSO
.Xr sievelog 1

http://code.google.com/p/sievelog/wiki/Syntax
.Sh AUTHORS
.An Jesse Kempf (jessekempf@gmail.com)
.Sh BUGS
The mail action's syntax is arguably lame.
